Bulletin
4notify Singapore · Government Gazette
OFFICIAL · GovTech · Singpass · Myinfo
Bulletin No
BUL-SG-004
Date
2026-05-27
Status
In force
Category
Digital government

Singpass, Myinfo and Sign with Singpass: one-time passcode delivery to Singapore citizens and residents

Whereas, in exercise of the powers conferred by the Public Sector (Governance) Act and the Electronic Transactions Act, the Government Technology Agency (GovTech) operates Singpass — the national digital identity used by virtually every adult in Singapore — alongside Myinfo (verified attribute exchange) and Sign with Singpass (legally recognised electronic signing). 4notify integrates with GovTech notification gateways and delivers government appointment reminders, service-ready notices and Sign with Singpass OTPs, with NRIC/FIN masking at the envelope layer.

PushSMSEmail
Preamble

Whereas, in exercise of the powers conferred by the Electronic Transactions Act and the PDPA, and in alignment with GovTech's Singpass technical guidance, the present Bulletin is hereby published concerning the delivery of Singpass, Myinfo and Sign with Singpass notifications.

Statutory basis
Electronic Transactions Act (Cap. 88)

Statutory basis for electronic signatures and recognised digital identity (Sign with Singpass).

Public Sector (Governance) Act

Sharing of data across government agencies through the Singpass and Myinfo platforms.

GovTech Singpass technical guidance

Integration patterns for the Singpass Login API, Myinfo and the Sign with Singpass workflow.

Implementation
01

GovTech gateway integration

4notify integrates with the GovTech notification gateway; quarterly penetration testing maintained.

02

NRIC and FIN masking

The delivery envelope carries only a hashed NRIC/FIN (SHA-256 with salt); the unmasked identifier stays inside the agency system.

03

Three-channel cascade

Service ready: push (instant) → SMS (2 minutes) → email (5 minutes); the citizen's channel preference lives inside the Singpass profile and is honoured at every fallback hop.

04

Sign with Singpass OTP delivery

OTPs for Sign with Singpass and Myinfo consent flows are delivered inside a 60-second window; if SMS fails, the cascade falls back to email.

Delivery envelope
json
{
  "event": "gov.service.ready",
  "uin_hash": "sha256:salt:7f2a9b...",
  "agency": "IRAS",
  "agency_name": "Inland Revenue Authority of Singapore",
  "channels": ["push", "sms", "email"],
  "cascade_window_min": 5
}
Sample message
PushSubject: Your service is ready

Singpass: Your IRAS Notice of Assessment is ready for retrieval with Sign with Singpass. Expires Friday 6pm. Open the app to continue.

Compliance checklist
  • GovTech notification gateway integration active
  • NRIC/FIN masking (SHA-256 with salt) enforced at envelope layer
  • Citizen channel preference cascade implemented
  • OTP P50 measured at or below 4 seconds across all four operators
The 4notify difference

4notify is the only A2P provider with native integration into the GovTech Singpass notification gateway, NRIC/FIN masking at the envelope layer and a curated template library for service-ready and Sign with Singpass notices aligned to the Electronic Transactions Act.

Frequently asked questions
Can 4notify see the customer's NRIC or FIN?

No. The delivery envelope carries only a salted SHA-256 hash; the issuing agency retains the cleartext NRIC/FIN and resolves the hash locally.

Does this work for HDB, CPF or ICA appointments?

Yes — appointment reminders from any agency integrated through the GovTech notification gateway ride the same envelope, on the channel the citizen has chosen in their Singpass profile.

Published
4notify Operations Office
2026-05-27 · BUL-SG-004

Start free

14 days, no card. English support on weekdays.

Other entries in this issue